Method for performing automated systematic entitlement review

Abstract

A computer-implemented method and system for performing automated systematic entitlement review is disclosed. The method comprises retrieving metadata concerning the one or more entitlements and the one or more users having those entitlements; selecting a first one or more instances of an entitlement and its user for revocation, and a second one or more instances of an entitlement and its user to be retained without revocation; automatically revoking access of the entitlements in the first one or more instances; and automatically notifying the users in the first one or more instances of the automatic revocation. In one family of variants, revocations are performed via probabilistic sampling, while in another family of variants, revocation are performed based on a “use it or lose it” scheme.

What is claimed is: 
     
         1 . A system for performing automated systematic entitlement review, comprising:
 a data store tracking one or more software entitlements available to one or more users;   a server enforcing the one or more entitlements by permitting or denying access to the one or more users to perform one or more given tasks; and   non-transitory memory storing instructions that, when executed by a computer processor, cause the computer processor to:   retrieve metadata concerning the one or more entitlements and the one or more users having those entitlements;   generate a numerical score for assigning to each of the one or more entitlements;   determine a probability of revocation for each user having each of the one or more entitlements, according to the numerical score assigned to each of the one or more entitlements;   select a first one or more instances of an entitlement and its user for revocation, and a second one or more instances of an entitlement and its user to be retained without revocation;   for each entitlement and for each user having that entitlement, use random number generation to revoke that entitlement for that user with a probability equal to the determined probability of revocation;   automatically revoke access of the entitlements in the first one or more instances; and   automatically notify the users in the first one or more instances of the automatic revocation.   
     
     
         2 . The system of  claim 1 , wherein the non-transitory memory stores instructions that, when executed by a computer processor, further causes the computer processor to:
 determine the probability of revocation as a constant probability of revocation per interval of time, such that after a recurrence of periodic probabilistic revocations, a predetermined probability of revocation over a longer time interval is achieved.   
     
     
         3 . The system of  claim 1 , wherein the non-transitory memory stores instructions that, when executed by a computer processor, further causes the computer processor to:
 based at least in part on one or more users' responses to revocation of entitlements, regenerate an updated score for each entitlement, such that a challenged revocation makes future revocations less probable, and an unchallenged revocation makes future revocations more probable.   
     
     
         4 . The system of  claim 1 , further comprising a data store tracking timestamped instances of each use of the one or more entitlements by each user possessing the entitlement, and wherein the non-transitory memory stores instructions that, when executed by a computer processor, further causes the computer processor to: revoke an entitlement from a user based at least in part on a predetermined duration of time having elapsed since a most recent use of the entitlement. 
     
     
         5 . The system of  claim 1 , wherein a user interface is provided to allow an affected user to challenge a revocation of that user's entitlement. 
     
     
         6 . The system of  claim 5 , wherein a user interface is provided to allow restoration of the entitlement subsequent to a challenge. 
     
     
         7 . The system of  claim 6 , wherein restoration only occurs if permitted after review by a user different from the user affected by the revocation. 
     
     
         8 . The system of  claim 1 , wherein an automated machine learning agent is used to determine expected entitlements for a particular user based on entitlements currently granted to users different from the particular user. 
     
     
         9 . The system of  claim 1 , wherein an automated machine learning agent is used to determine whether a particular user's actual use of entitlements is anomalous, compared to use of entitlements by users different from the particular user. 
     
     
         10 . A computer-implemented method for performing automated systematic entitlement review, comprising:
 retrieving metadata concerning the one or more entitlements and the one or more users having those entitlements;   generating a numerical score for assigning to each of the one or more entitlements;   determining a probability of revocation for each user having each of the one or more entitlements, according to the numerical score assigned to each of the one or more entitlements;   selecting a first one or more instances of an entitlement and its user for revocation, and a second one or more instances of an entitlement and its user to be retained without revocation;   for each entitlement and for each user having that entitlement, using random number generation to revoke that entitlement for that user with a probability equal to the determined probability of revocation;   automatically revoking access of the entitlements in the first one or more instances; and   automatically notifying the users in the first one or more instances of the automatic revocation.   
     
     
         11 . The method of  claim 10 , further comprising:
 determining the probability of revocation as a constant probability of revocation per interval of time, such that after a recurrence of periodic probabilistic revocations, a predetermined probability of revocation over a longer time interval is achieved.   
     
     
         12 . The method of  claim 10 , further comprising:
 based at least in part on one or more users' responses to revocation of entitlements, regenerate an updated score for each entitlement, such that a challenged revocation makes future revocations less probable, and an unchallenged revocation makes future revocations more probable.   
     
     
         13 . The method of  claim 10 , further comprising:
 revoking an entitlement from a user based at least in part on a predetermined duration of time having elapsed since a most recent use of the entitlement.   
     
     
         14 . The method of  claim 10 , wherein a user interface is provided to allow an affected user to challenge a revocation of that user's entitlement. 
     
     
         15 . The method of  claim 14 , wherein a user interface is provided to allow restoration of the entitlement subsequent to a challenge. 
     
     
         16 . The method of  claim 15 , wherein restoration only occurs if permitted after review by a user different from the user affected by the revocation. 
     
     
         17 . The method of  claim 10 , wherein an automated machine learning agent is used to determine expected entitlements for a particular user based on entitlements currently granted to users different from the particular user. 
     
     
         18 . The method of  claim 10 , wherein an automated machine learning agent is used to determine whether a particular user's actual use of entitlements is anomalous, compared to use of entitlements by users different from the particular user.